Extend runtime auth to account, plugin, and file requests (#59564)

## What changed

- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.

## Testing

Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.

GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805

codex-rs/core/src/plugins/mod.rs

@@ -44,3 +44,39 @@ pub fn plugins_manager_for_config(
         skill_root_loader,
     )
 }
+
+/// Initialize a standalone command's runtime before it can make first-party plugin requests.
+/// Callers that own a ThreadManager should reuse that manager's PluginsManager instead.
+pub async fn plugins_manager_for_config_with_runtime(
+    config: &Config,
+    auth_manager: Arc<AuthManager>,
+) -> anyhow::Result<PluginsManager> {
+    if !config
+        .features
+        .enabled(codex_features::Feature::RuntimeAgentInstances)
+    {
+        return Ok(plugins_manager_for_config(config, auth_manager));
+    }
+    codex_model_provider::validate_runtime_destination(Some(&config.chatgpt_base_url))?;
+    if !codex_runtime_agent_instance::is_openai_api_url(&config.chatgpt_base_url) {
+        return Ok(plugins_manager_for_config(config, auth_manager));
+    }
+    let installation_id =
+        crate::installation_id::resolve_installation_id(&config.codex_home).await?;
+    let runtime = crate::runtime_auth::build_runtime_auth_manager(
+        config,
+        Arc::clone(&auth_manager),
+        &installation_id,
+    );
+    let slot = Arc::new(runtime.map(std::sync::OnceLock::from).unwrap_or_default());
+    Ok(PluginsManager::new_with_options(
+        config.codex_home.to_path_buf(),
+        Some(codex_protocol::protocol::Product::Codex),
+        auth_manager,
+        slot,
+        Arc::new(HostSkillsService::new(
+            config.codex_home.clone(),
+            /*bundled_skills_enabled*/ false,
+        )),
+    ))
+}

codex-rs/core/src/plugins/skill_snapshot_tests.rs

@@ -57,6 +57,7 @@ enabled = false
         codex_home.path().to_path_buf(),
         Some(Product::Codex),
         AuthManager::from_auth_for_testing(CodexAuth::create_dummy_chatgpt_auth_for_testing()),
+        codex_runtime_agent_instance::RuntimeAuthSlot::default(),
         skills_service.clone(),
     );
     let plugin_outcome = plugins_manager.plugins_for_config(&plugins_input).await;